5c7dbedd1c59b6ac110f757a76452d8f4b1c74defaf91a1f3544ab1d09846873

Analysis

max time kernel
136s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 12:42

Target

5c7dbedd1c59b6ac110f757a76452d8f4b1c74defaf91a1f3544ab1d09846873.dll
Size

2.1MB
MD5

ad1dcae850c7620c5273ed78c063e9f5
SHA1

ce4704d5ede554406a469e1c220da9afad71b8ef
SHA256

5c7dbedd1c59b6ac110f757a76452d8f4b1c74defaf91a1f3544ab1d09846873
SHA512

a0e7547e431483aac7290b0c74949d1c53f25a95a13153ce5abe32749e9bc8e111dbd6d57b266e8247b017f42e377d72c53b3059fddf651c6c91f0f3075bbce0
SSDEEP

49152:y8feI79oK2xGrHv31PnbhJ/P0BDpinATs75a78t/:y8D7WK2C/t8BDpgh08t/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3824	776	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 776	4100	rundll32.exe	83
PID 4100 wrote to memory of 776	4100	rundll32.exe	83
PID 4100 wrote to memory of 776	4100	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c7dbedd1c59b6ac110f757a76452d8f4b1c74defaf91a1f3544ab1d09846873.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c7dbedd1c59b6ac110f757a76452d8f4b1c74defaf91a1f3544ab1d09846873.dll,#1
  2⤵
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 560
    3⤵
    - Program crash
    PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 776 -ip 776
1⤵
PID:4140